---
title: Security advisory 2026-04-09
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

## CAPTCHA bypass vulnerability in reCAPTCHA v2 validation

**CVSS**: 6.9\
**Affected versions**: 22.0.0 - 31.3.2\
**Category**: Forms

### Summary

A potential vulnerability was identified in the server-side validation logic of the [reCAPTCHA form component](https://docs.kentico.com/documentation/developers-and-admins/development/builders/form-builder/reference-form-builder-components.md) used in the [Form Builder](https://docs.kentico.com/documentation/developers-and-admins/development/builders/form-builder.md).

Under specific conditions the validation method could fail and incorrectly accept submissions. Successful exploitation could allow an unauthenticated attacker to bypass reCAPTCHA v2 protection and submit requests that should otherwise have been blocked. This could enable spam submissions through forms or increased load on form-based workflows.

This vulnerability was addressed by updating the validation logic to rely on the success flag returned by the reCAPTCHA provider.

### How to fix

Update to the latest Xperience by Kentico version. See [Update Xperience by Kentico projects](https://docs.kentico.com/documentation/developers-and-admins/installation/update-xperience-by-kentico-projects.md) for detailed instructions.